CriminalIP

Details

ID	`CriminalIP`
Provider	AI Spera
Category	Data Enrichment & Threat Intelligence
From Version	6.10.0
Docker Image	`demisto/python3:3.12.11.4508456`

README

Criminal IP is a comprehensive cyber threat intelligence solution that provides actionable insights into IP addresses, domains, and connected assets across the internet.
It enables organizations to detect malicious indicators, assess asset reputation, and enhance threat detection by integrating enriched threat data directly into security operations via the XSOAR interface.

This integration was integrated and tested with version 1.0.0 of CriminalIP.

Configure CriminalIP in Cortex

Parameter	Description	Required
API Key	The API Key to use for connection	False
Server URL	The base URL of the Criminal IP API.	True
Trust any certificate (not secure)	When set to true, SSL certificates will not be validated.	False
Use system proxy settings	Use the system proxy settings to communicate with the API.	False
Request timeout (seconds)	Timeout for HTTP requests in seconds. Default is 30.	False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

criminal-ip-ip-report

Provides detailed information about an IP address using Criminal IP’s API.

Base Command

criminal-ip-ip-report

Input

Argument Name	Description	Required
ip	The IP address to search.	Required

Context Output

Path	Type	Description
CriminalIP.IP.IP	String	Queried IP address.
CriminalIP.IP.InboundScore	String	Inbound reputation score.
CriminalIP.IP.OutboundScore	String	Outbound reputation score.
CriminalIP.IP.Issues	String	Detected issues (VPN, Proxy, Tor, Hosting, Cloud, etc.)
CriminalIP.IP.ProtectedIPs	Number	Number of protected IPs related to this IP.
CriminalIP.IP.RelatedDomains	Number	Number of domains related to this IP.
CriminalIP.IP.ASN	Number	Autonomous System Number (ASN).
CriminalIP.IP.ASName	String	Autonomous System Name.
CriminalIP.IP.Org	String	Organization name from Whois.
CriminalIP.IP.Country	String	Country code from Whois.
CriminalIP.IP.Hostname	String	Resolved hostname.
CriminalIP.IP.OpenPorts	Number	Number of open ports detected.
CriminalIP.IP.ObservedPort	Number	Example open port number.
CriminalIP.IP.ObservedService	String	Example service detected on an open port.
CriminalIP.IP.Vulnerabilities	Number	Number of vulnerabilities detected on the IP.
CriminalIP.IP.ObservedCVE	String	Example CVE ID detected on the IP.
CriminalIP.IP.ObservedCVSS	Number	Example CVSS v3 score of detected vulnerability.
CriminalIP.IP.raw	Unknown	Full raw response from CriminalIP API.

Example

!criminal-ip-ip-report ip=8.8.8.8

criminal-ip-check-malicious-ip

Determines whether an IP is malicious or safe through CriminalIP Asset Search.

Base Command

criminal-ip-check-malicious-ip

Input

Argument Name	Description	Required
ip	IP Address to check.	Required

Context Output

Path	Type	Description
CriminalIP.Mal_IP.ip	String	Queried IP address.
CriminalIP.Mal_IP.malicious	Boolean	Whether the IP was detected as malicious.
CriminalIP.Mal_IP.real_ip_list	Unknown	List of real IPs if protected IP was detected.
CriminalIP.Mal_IP.raw	Unknown	Full raw response.

Example

!criminal-ip-check-malicious-ip ip=192.168.1.1

criminal-ip-check-last-scan-date

Checks if the domain has been scanned within the last 7 days.

Base Command

criminal-ip-check-last-scan-date

Input

Argument Name	Description	Required
domain	The domain to check last scan date for.	Required

Context Output

Path	Type	Description
CriminalIP.Scan_Date.domain	String	Queried Domain.
CriminalIP.Scan_Date.scan_id	String	The last scan ID of the domain.
CriminalIP.Scan_Date.scanned	Boolean	Whether the domain was scanned within the last 7 days.
CriminalIP.Scan_Date.scan_date	String	The last scan date in ISO format.
CriminalIP.Scan_Date.raw	Unknown	Full raw response from CriminalIP API.

Example

!criminal-ip-check-last-scan-date domain=example.com

criminal-ip-domain-quick-scan

Performs a Domain Quick Scan using CriminalIP’s API.

Base Command

criminal-ip-domain-quick-scan

Input

Argument Name	Description	Required
domain	The domain to perform Quick Scan.	Required

Context Output

Path	Type	Description
CriminalIP.Domain_Quick.domain	String	Queried Domain.
CriminalIP.Domain_Quick.reg_dtime	String	Domain registration time.
CriminalIP.Domain_Quick.result	String	Quick scan result string.
CriminalIP.Domain_Quick.type	String	Domain type classification.
CriminalIP.Domain_Quick.raw	Unknown	Full raw response.

Example

!criminal-ip-domain-quick-scan domain=example.com

criminal-ip-domain-lite-scan

Initiates a Domain Lite Scan and returns a scan_id.

Base Command

criminal-ip-domain-lite-scan

Input

Argument Name	Description	Required
domain	The domain to perform Lite Scan.	Required

Context Output

Path	Type	Description
CriminalIP.Domain_Lite.scan_id	String	Scan ID returned for Lite Scan.
CriminalIP.Domain_Lite.raw	Unknown	Full raw response.

Example

!criminal-ip-domain-lite-scan domain=example.com

criminal-ip-domain-lite-scan-status

Checks the progress of the Lite Scan.

Base Command

criminal-ip-domain-lite-scan-status

Input

Argument Name	Description	Required
scan_id	The scan_id whose Lite Scan progress to check.	Required

Context Output

Path	Type	Description
CriminalIP.Domain_Lite_Status.status	String	Lite Scan status.
CriminalIP.Domain_Lite_Status.scan_percentage	Number	Scan percentage progress.
CriminalIP.Domain_Lite_Status.raw	Unknown	Full raw response.

Example

!criminal-ip-domain-lite-scan-status scan_id=abc123def456

criminal-ip-domain-lite-scan-result

Returns the Lite Scan results for the given scan_id.

Base Command

criminal-ip-domain-lite-scan-result

Input

Argument Name	Description	Required
scan_id	The scan_id whose Lite Scan result to fetch.	Required

Context Output

Path	Type	Description
CriminalIP.Domain_Lite_Result.domain	String	Queried Domain.
CriminalIP.Domain_Lite_Result.created	String	Domain creation date.
CriminalIP.Domain_Lite_Result.registrar	String	Domain registrar.
CriminalIP.Domain_Lite_Result.score	String	Domain risk score.
CriminalIP.Domain_Lite_Result.report_time	String	Report generation time.
CriminalIP.Domain_Lite_Result.phishing_prob	Number	Phishing probability.
CriminalIP.Domain_Lite_Result.dga_score	Number	DGA score.
CriminalIP.Domain_Lite_Result.abuse_critical	Number	Critical abuse record count.
CriminalIP.Domain_Lite_Result.abuse_dangerous	Number	Dangerous abuse record count.
CriminalIP.Domain_Lite_Result.a_records	String	A records resolved.
CriminalIP.Domain_Lite_Result.ns_records	String	NS records resolved.
CriminalIP.Domain_Lite_Result.mapped_ips	String	Mapped IP list.
CriminalIP.Domain_Lite_Result.raw	Unknown	Full raw response.

Example

!criminal-ip-domain-lite-scan-result scan_id=abc123def456

criminal-ip-domain-full-scan

Initiates a Domain Full Scan and returns a scan_id.

Base Command

criminal-ip-domain-full-scan

Input

Argument Name	Description	Required
domain	The domain to perform Full Scan.	Required

Context Output

Path	Type	Description
CriminalIP.Full_Scan.scan_id	String	Scan ID returned for Full Scan.
CriminalIP.Full_Scan.raw	Unknown	Full raw response.

Example

!criminal-ip-domain-full-scan domain=example.com

criminal-ip-domain-full-scan-status

Checks the progress of the Full Scan.

Base Command

criminal-ip-domain-full-scan-status

Input

Argument Name	Description	Required
scan_id	The scan_id whose Full Scan status to check.	Required

Context Output

Path	Type	Description
CriminalIP.Full_Scan_Status.status	String	Full Scan status.
CriminalIP.Full_Scan_Status.scan_percentage	Number	Scan percentage progress.
CriminalIP.Full_Scan_Status.raw	Unknown	Full raw response.

Example

!criminal-ip-domain-full-scan-status scan_id=xyz789abc123

criminal-ip-domain-full-scan-result

Returns the Full Scan results for the given scan_id.

Base Command

criminal-ip-domain-full-scan-result

Input

Argument Name	Description	Required
scan_id	The scan_id whose Full Scan result to fetch.	Required

Context Output

Path	Type	Description
CriminalIP.Full_Scan_Result.domain	String	Queried Domain.
CriminalIP.Full_Scan_Result.created	String	Domain creation date.
CriminalIP.Full_Scan_Result.registrar	String	Domain registrar.
CriminalIP.Full_Scan_Result.score	String	Domain risk score.
CriminalIP.Full_Scan_Result.report_time	String	Report generation time.
CriminalIP.Full_Scan_Result.phishing_prob	Number	Phishing probability.
CriminalIP.Full_Scan_Result.dga_score	Number	DGA score.
CriminalIP.Full_Scan_Result.punycode	Boolean	Whether punycode detected.
CriminalIP.Full_Scan_Result.fake_https	Boolean	Whether fake HTTPS detected.
CriminalIP.Full_Scan_Result.abuse_critical	Number	Critical abuse record count.
CriminalIP.Full_Scan_Result.abuse_dangerous	Number	Dangerous abuse record count.
CriminalIP.Full_Scan_Result.cert_valid_to	String	Certificate valid until date.
CriminalIP.Full_Scan_Result.connected_ips	String	Connected IP list.
CriminalIP.Full_Scan_Result.ssl_vulns	String	SSL vulnerabilities detected.
CriminalIP.Full_Scan_Result.raw	Unknown	Full raw response.

Example

!criminal-ip-domain-full-scan-result scan_id=xyz789abc123

criminal-ip-domain-full-scan-make-email-body

Builds an email body summarizing notable findings from a completed Full Scan.

Base Command

criminal-ip-domain-full-scan-make-email-body

Input

Argument Name	Description	Required
scan_id	The scan_id of the completed Full Scan.	Required
domain	The domain of the completed Full Scan.	Required

Context Output

Path	Type	Description
CriminalIP.Email_Body.domain	String	Domain analyzed.
CriminalIP.Email_Body.scan_id	String	Scan ID used for generating the email body.
CriminalIP.Email_Body.domain_score	String	Domain score.
CriminalIP.Email_Body.phishing_prob	Number	Phishing probability.
CriminalIP.Email_Body.dga_score	Number	DGA score.
CriminalIP.Email_Body.registrar	String	Domain registrar.
CriminalIP.Email_Body.created	String	Domain creation date.
CriminalIP.Email_Body.report_time	String	Report generation time.
CriminalIP.Email_Body.abuse_critical	Number	Critical abuse record count.
CriminalIP.Email_Body.abuse_dangerous	Number	Dangerous abuse record count.
CriminalIP.Email_Body.fake_https	Boolean	Whether fake HTTPS detected.
CriminalIP.Email_Body.punycode	Boolean	Whether punycode detected.
CriminalIP.Email_Body.cert_valid_to	String	Certificate expiration date.
CriminalIP.Email_Body.connected_ips	String	Connected IP addresses (comma-separated).
CriminalIP.Email_Body.ssl_vulns	String	SSL vulnerabilities detected.
CriminalIP.Email_Body.readable_output	String	Pre-formatted Full Scan report (email-ready).
CriminalIP.Email_Body.raw	Unknown	Full raw response from Criminal IP API.

Example

!criminal-ip-domain-full-scan-make-email-body scan_id=xyz789abc123 domain=example.com

criminal-ip-micro-asm

Performs a micro ASM-style summary for a domain with a completed Full Scan.

Base Command

criminal-ip-micro-asm

Input

Argument Name	Description	Required
scan_id	The scan_id of the completed Full Scan.	Required
domain	The domain of the completed Full Scan.	Required

Context Output

Path	Type	Description
CriminalIP.Micro_ASM.domain	String	Domain analyzed.
CriminalIP.Micro_ASM.scan_id	String	Scan ID used for Micro ASM.
CriminalIP.Micro_ASM.domain_score	String	Domain score.
CriminalIP.Micro_ASM.phishing_prob	Number	Phishing probability.
CriminalIP.Micro_ASM.dga_score	Number	DGA score.
CriminalIP.Micro_ASM.registrar	String	Domain registrar.
CriminalIP.Micro_ASM.created	String	Domain creation date.
CriminalIP.Micro_ASM.report_time	String	Report generation time.
CriminalIP.Micro_ASM.abuse_critical	Number	Critical abuse record count.
CriminalIP.Micro_ASM.abuse_dangerous	Number	Dangerous abuse record count.
CriminalIP.Micro_ASM.fake_https	Boolean	Whether fake HTTPS detected.
CriminalIP.Micro_ASM.punycode	Boolean	Whether punycode detected.
CriminalIP.Micro_ASM.cert_valid_to	String	Certificate expiration date.
CriminalIP.Micro_ASM.connected_ips	String	Connected IP addresses (comma-separated).
CriminalIP.Micro_ASM.ssl_vulns	String	SSL vulnerabilities detected.
CriminalIP.Micro_ASM.readable_output	String	Pre-formatted Micro ASM report (email-ready).
CriminalIP.Micro_ASM.raw	Unknown	Full raw response from CriminalIP API.

Example

!criminal-ip-micro-asm scan_id=xyz789abc123 domain=example.com

Resources

Configuration parameters

credentials —
url — Server URL (required)
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings
request_timeout — Request timeout (seconds)

Commands (12)

criminal-ip-check-last-scan-date
Checks if the domain has been scanned within the last 7 days.
criminal-ip-check-malicious-ip
Determines whether an IP is malicious or safe through CriminalIP Asset Search.
criminal-ip-domain-full-scan
Initiates a Domain Full Scan and returns a scan_id.
criminal-ip-domain-full-scan-make-email-body
Builds an email body summarizing notable findings from a completed Full Scan.
criminal-ip-domain-full-scan-result
Returns the Full Scan results for the given scan_id.
criminal-ip-domain-full-scan-status
Checks the progress of the Full Scan.
criminal-ip-domain-lite-scan
Initiates a Domain Lite Scan and returns a scan_id.
criminal-ip-domain-lite-scan-result
Returns the Lite Scan results for the given scan_id.
criminal-ip-domain-lite-scan-status
Checks the progress of the Lite Scan.
criminal-ip-domain-quick-scan
Performs a Domain Quick Scan using CriminalIP's API.
criminal-ip-ip-report
Provides detailed information about an IP address using Criminal IP's API.
criminal-ip-micro-asm
Performs a micro ASM-style summary for a domain with a completed Full Scan.

Source

CriminalIP.py CriminalIP_test.py CriminalIP.yml CriminalIP_description.md

Download History Raw

category: Data Enrichment & Threat Intelligence
provider: AI Spera
sectionorder:
- Connect
- Collect
commonfields:
  id: CriminalIP
  version: -1

configuration:
- displaypassword: API Key
  additionalinfo: The API Key to use for connection
  name: credentials
  required: false
  hiddenusername: true
  section: Connect
  type: 9

- display: Server URL
  name: url
  type: 0
  required: true
  additionalinfo: "The base URL of the Criminal IP API."
  section: Connect

- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
  additionalinfo: When set to true, SSL certificates will not be validated.

- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
  additionalinfo: Use the system proxy settings to communicate with the API.

- display: Request timeout (seconds)
  name: request_timeout
  type: 0
  required: false
  section: Connect
  defaultvalue: "30"
  additionalinfo: Timeout for HTTP requests in seconds. Default is 30.

description: |
  Criminal IP is a comprehensive cyber threat intelligence solution that provides actionable insights into IP addresses, domains, and connected assets across the internet.
  It enables organizations to detect malicious indicators, assess asset reputation, and enhance threat detection by integrating enriched threat data directly into security operations via the XSOAR interface.

name: CriminalIP
display: CriminalIP

script:
  type: python
  subtype: python3
  dockerimage: demisto/python3:3.12.11.4508456
  script: '-'
  runonce: false
  isfetch: false
  commands:

  # --- IP Report ---
  - name: criminal-ip-ip-report
    description: Provides detailed information about an IP address using Criminal IP's API.
    arguments:
    - name: ip
      description: The IP address to search.
      required: true
      default: true
      type: String
    outputs:
    - contextPath: CriminalIP.IP.IP
      description: Queried IP address.
      type: String
    - contextPath: CriminalIP.IP.InboundScore
      description: Inbound reputation score.
      type: String
    - contextPath: CriminalIP.IP.OutboundScore
      description: Outbound reputation score.
      type: String
    - contextPath: CriminalIP.IP.Issues
      description: Detected issues (VPN, Proxy, Tor, Hosting, Cloud, etc.)
      type: String
    - contextPath: CriminalIP.IP.ProtectedIPs
      description: Number of protected IPs related to this IP.
      type: Number
    - contextPath: CriminalIP.IP.RelatedDomains
      description: Number of domains related to this IP.
      type: Number
    - contextPath: CriminalIP.IP.ASN
      description: Autonomous System Number (ASN).
      type: Number
    - contextPath: CriminalIP.IP.ASName
      description: Autonomous System Name.
      type: String
    - contextPath: CriminalIP.IP.Org
      description: Organization name from Whois.
      type: String
    - contextPath: CriminalIP.IP.Country
      description: Country code from Whois.
      type: String
    - contextPath: CriminalIP.IP.Hostname
      description: Resolved hostname.
      type: String
    - contextPath: CriminalIP.IP.OpenPorts
      description: Number of open ports detected.
      type: Number
    - contextPath: CriminalIP.IP.ObservedPort
      description: Example open port number.
      type: Number
    - contextPath: CriminalIP.IP.ObservedService
      description: Example service detected on an open port.
      type: String
    - contextPath: CriminalIP.IP.Vulnerabilities
      description: Number of vulnerabilities detected on the IP.
      type: Number
    - contextPath: CriminalIP.IP.ObservedCVE
      description: Example CVE ID detected on the IP.
      type: String
    - contextPath: CriminalIP.IP.ObservedCVSS
      description: Example CVSS v3 score of detected vulnerability.
      type: Number
    - contextPath: CriminalIP.IP.raw
      description: Full raw response from CriminalIP API.
      type: Unknown

  # --- Check Malicious IP ---
  - name: criminal-ip-check-malicious-ip
    description: Determines whether an IP is malicious or safe through CriminalIP Asset Search.
    arguments:
    - name: ip
      description: IP Address to check.
      required: true
      default: true
      type: String
    outputs:
    - contextPath: CriminalIP.Mal_IP.ip
      description: Queried IP address.
      type: String
    - contextPath: CriminalIP.Mal_IP.malicious
      description: Whether the IP was detected as malicious.
      type: Boolean
    - contextPath: CriminalIP.Mal_IP.real_ip_list
      description: List of real IPs if protected IP was detected.
      type: Unknown
    - contextPath: CriminalIP.Mal_IP.raw
      description: Full raw response.
      type: Unknown

  # --- Check Last Scan Date ---
  - name: criminal-ip-check-last-scan-date
    description: Checks if the domain has been scanned within the last 7 days.
    arguments:
    - name: domain
      description: The domain to check last scan date for.
      required: true
      default: true
      type: String
    outputs:
    - contextPath: CriminalIP.Scan_Date.domain
      description: Queried Domain.
      type: String
    - contextPath: CriminalIP.Scan_Date.scan_id
      description: The last scan ID of the domain.
      type: String
    - contextPath: CriminalIP.Scan_Date.scanned
      description: Whether the domain was scanned within the last 7 days.
      type: Boolean
    - contextPath: CriminalIP.Scan_Date.scan_date
      description: The last scan date in ISO format.
      type: String
    - contextPath: CriminalIP.Scan_Date.raw
      description: Full raw response from CriminalIP API.
      type: Unknown

  # --- Domain Quick Scan ---
  - name: criminal-ip-domain-quick-scan
    description: Performs a Domain Quick Scan using CriminalIP's API.
    arguments:
    - name: domain
      description: The domain to perform Quick Scan.
      required: true
      default: true
      type: String
    outputs:
    - contextPath: CriminalIP.Domain_Quick.domain
      description: Queried Domain.
      type: String
    - contextPath: CriminalIP.Domain_Quick.reg_dtime
      description: Domain registration time.
      type: String
    - contextPath: CriminalIP.Domain_Quick.result
      description: Quick scan result string.
      type: String
    - contextPath: CriminalIP.Domain_Quick.type
      description: Domain type classification.
      type: String
    - contextPath: CriminalIP.Domain_Quick.raw
      description: Full raw response.
      type: Unknown

  # --- Domain Lite Scan ---
  - name: criminal-ip-domain-lite-scan
    description: Initiates a Domain Lite Scan and returns a scan_id.
    arguments:
    - name: domain
      description: The domain to perform Lite Scan.
      required: true
      default: true
      type: String
    outputs:
    - contextPath: CriminalIP.Domain_Lite.scan_id
      description: Scan ID returned for Lite Scan.
      type: String
    - contextPath: CriminalIP.Domain_Lite.raw
      description: Full raw response.
      type: Unknown

  - name: criminal-ip-domain-lite-scan-status
    description: Checks the progress of the Lite Scan.
    arguments:
    - name: scan_id
      description: The scan_id whose Lite Scan progress to check.
      required: true
      default: true
      type: String
    outputs:
    - contextPath: CriminalIP.Domain_Lite_Status.status
      description: Lite Scan status.
      type: String
    - contextPath: CriminalIP.Domain_Lite_Status.scan_percentage
      description: Scan percentage progress.
      type: Number
    - contextPath: CriminalIP.Domain_Lite_Status.raw
      description: Full raw response.
      type: Unknown

  - name: criminal-ip-domain-lite-scan-result
    description: Returns the Lite Scan results for the given scan_id.
    arguments:
    - name: scan_id
      description: The scan_id whose Lite Scan result to fetch.
      required: true
      default: true
      type: String
    outputs:
    - contextPath: CriminalIP.Domain_Lite_Result.domain
      description: Queried Domain.
      type: String
    - contextPath: CriminalIP.Domain_Lite_Result.created
      description: Domain creation date.
      type: String
    - contextPath: CriminalIP.Domain_Lite_Result.registrar
      description: Domain registrar.
      type: String
    - contextPath: CriminalIP.Domain_Lite_Result.score
      description: Domain risk score.
      type: String
    - contextPath: CriminalIP.Domain_Lite_Result.report_time
      description: Report generation time.
      type: String
    - contextPath: CriminalIP.Domain_Lite_Result.phishing_prob
      description: Phishing probability.
      type: Number
    - contextPath: CriminalIP.Domain_Lite_Result.dga_score
      description: DGA score.
      type: Number
    - contextPath: CriminalIP.Domain_Lite_Result.abuse_critical
      description: Critical abuse record count.
      type: Number
    - contextPath: CriminalIP.Domain_Lite_Result.abuse_dangerous
      description: Dangerous abuse record count.
      type: Number
    - contextPath: CriminalIP.Domain_Lite_Result.a_records
      description: A records resolved.
      type: String
    - contextPath: CriminalIP.Domain_Lite_Result.ns_records
      description: NS records resolved.
      type: String
    - contextPath: CriminalIP.Domain_Lite_Result.mapped_ips
      description: Mapped IP list.
      type: String
    - contextPath: CriminalIP.Domain_Lite_Result.raw
      description: Full raw response.
      type: Unknown

  # --- Domain Full Scan ---
  - name: criminal-ip-domain-full-scan
    description: Initiates a Domain Full Scan and returns a scan_id.
    arguments:
    - name: domain
      description: The domain to perform Full Scan.
      required: true
      default: true
      type: String
    outputs:
    - contextPath: CriminalIP.Full_Scan.scan_id
      description: Scan ID returned for Full Scan.
      type: String
    - contextPath: CriminalIP.Full_Scan.raw
      description: Full raw response.
      type: Unknown

  - name: criminal-ip-domain-full-scan-status
    description: Checks the progress of the Full Scan.
    arguments:
    - name: scan_id
      description: The scan_id whose Full Scan status to check.
      required: true
      default: true
      type: String
    outputs:
    - contextPath: CriminalIP.Full_Scan_Status.status
      description: Full Scan status.
      type: String
    - contextPath: CriminalIP.Full_Scan_Status.scan_percentage
      description: Scan percentage progress.
      type: Number
    - contextPath: CriminalIP.Full_Scan_Status.raw
      description: Full raw response.
      type: Unknown

  - name: criminal-ip-domain-full-scan-result
    description: Returns the Full Scan results for the given scan_id.
    arguments:
    - name: scan_id
      description: The scan_id whose Full Scan result to fetch.
      required: true
      default: true
      type: String
    outputs:
    - contextPath: CriminalIP.Full_Scan_Result.domain
      description: Queried Domain.
      type: String
    - contextPath: CriminalIP.Full_Scan_Result.created
      description: Domain creation date.
      type: String
    - contextPath: CriminalIP.Full_Scan_Result.registrar
      description: Domain registrar.
      type: String
    - contextPath: CriminalIP.Full_Scan_Result.score
      description: Domain risk score.
      type: String
    - contextPath: CriminalIP.Full_Scan_Result.report_time
      description: Report generation time.
      type: String
    - contextPath: CriminalIP.Full_Scan_Result.phishing_prob
      description: Phishing probability.
      type: Number
    - contextPath: CriminalIP.Full_Scan_Result.dga_score
      description: DGA score.
      type: Number
    - contextPath: CriminalIP.Full_Scan_Result.punycode
      description: Whether punycode detected.
      type: Boolean
    - contextPath: CriminalIP.Full_Scan_Result.fake_https
      description: Whether fake HTTPS detected.
      type: Boolean
    - contextPath: CriminalIP.Full_Scan_Result.abuse_critical
      description: Critical abuse record count.
      type: Number
    - contextPath: CriminalIP.Full_Scan_Result.abuse_dangerous
      description: Dangerous abuse record count.
      type: Number
    - contextPath: CriminalIP.Full_Scan_Result.cert_valid_to
      description: Certificate valid until date.
      type: String
    - contextPath: CriminalIP.Full_Scan_Result.connected_ips
      description: Connected IP list.
      type: String
    - contextPath: CriminalIP.Full_Scan_Result.ssl_vulns
      description: SSL vulnerabilities detected.
      type: String
    - contextPath: CriminalIP.Full_Scan_Result.raw
      description: Full raw response.
      type: Unknown

  # --- Full Scan Email Body ---
  - name: criminal-ip-domain-full-scan-make-email-body
    description: Builds an email body summarizing notable findings from a completed Full Scan.
    arguments:
    - name: scan_id
      description: The scan_id of the completed Full Scan.
      required: true
      default: true
      type: String
    - name: domain
      description: The domain of the completed Full Scan.
      required: true
      type: String
    outputs:
    - contextPath: CriminalIP.Email_Body.domain
      description: Domain analyzed.
      type: String
    - contextPath: CriminalIP.Email_Body.scan_id
      description: Scan ID used for generating the email body.
      type: String
    - contextPath: CriminalIP.Email_Body.domain_score
      description: Domain score.
      type: String
    - contextPath: CriminalIP.Email_Body.phishing_prob
      description: Phishing probability.
      type: Number
    - contextPath: CriminalIP.Email_Body.dga_score
      description: DGA score.
      type: Number
    - contextPath: CriminalIP.Email_Body.registrar
      description: Domain registrar.
      type: String
    - contextPath: CriminalIP.Email_Body.created
      description: Domain creation date.
      type: String
    - contextPath: CriminalIP.Email_Body.report_time
      description: Report generation time.
      type: String
    - contextPath: CriminalIP.Email_Body.abuse_critical
      description: Critical abuse record count.
      type: Number
    - contextPath: CriminalIP.Email_Body.abuse_dangerous
      description: Dangerous abuse record count.
      type: Number
    - contextPath: CriminalIP.Email_Body.fake_https
      description: Whether fake HTTPS detected.
      type: Boolean
    - contextPath: CriminalIP.Email_Body.punycode
      description: Whether punycode detected.
      type: Boolean
    - contextPath: CriminalIP.Email_Body.cert_valid_to
      description: Certificate expiration date.
      type: String
    - contextPath: CriminalIP.Email_Body.connected_ips
      description: Connected IP addresses (comma-separated).
      type: String
    - contextPath: CriminalIP.Email_Body.ssl_vulns
      description: SSL vulnerabilities detected.
      type: String
    - contextPath: CriminalIP.Email_Body.readable_output
      description: Pre-formatted Full Scan report (email-ready).
      type: String
    - contextPath: CriminalIP.Email_Body.raw
      description: Full raw response from Criminal IP API.
      type: Unknown
  # --- Micro ASM ---
  - name: criminal-ip-micro-asm
    description: Performs a micro ASM-style summary for a domain with a completed Full Scan.
    arguments:
    - name: scan_id
      description: The scan_id of the completed Full Scan.
      required: true
      default: true
      type: String
    - name: domain
      description: The domain of the completed Full Scan.
      required: true
      type: String
    outputs:
    - contextPath: CriminalIP.Micro_ASM.domain
      description: Domain analyzed.
      type: String
    - contextPath: CriminalIP.Micro_ASM.scan_id
      description: Scan ID used for Micro ASM.
      type: String
    - contextPath: CriminalIP.Micro_ASM.domain_score
      description: Domain score.
      type: String
    - contextPath: CriminalIP.Micro_ASM.phishing_prob
      description: Phishing probability.
      type: Number
    - contextPath: CriminalIP.Micro_ASM.dga_score
      description: DGA score.
      type: Number
    - contextPath: CriminalIP.Micro_ASM.registrar
      description: Domain registrar.
      type: String
    - contextPath: CriminalIP.Micro_ASM.created
      description: Domain creation date.
      type: String
    - contextPath: CriminalIP.Micro_ASM.report_time
      description: Report generation time.
      type: String
    - contextPath: CriminalIP.Micro_ASM.abuse_critical
      description: Critical abuse record count.
      type: Number
    - contextPath: CriminalIP.Micro_ASM.abuse_dangerous
      description: Dangerous abuse record count.
      type: Number
    - contextPath: CriminalIP.Micro_ASM.fake_https
      description: Whether fake HTTPS detected.
      type: Boolean
    - contextPath: CriminalIP.Micro_ASM.punycode
      description: Whether punycode detected.
      type: Boolean
    - contextPath: CriminalIP.Micro_ASM.cert_valid_to
      description: Certificate expiration date.
      type: String
    - contextPath: CriminalIP.Micro_ASM.connected_ips
      description: Connected IP addresses (comma-separated).
      type: String
    - contextPath: CriminalIP.Micro_ASM.ssl_vulns
      description: SSL vulnerabilities detected.
      type: String
    - contextPath: CriminalIP.Micro_ASM.readable_output
      description: Pre-formatted Micro ASM report (email-ready).
      type: String
    - contextPath: CriminalIP.Micro_ASM.raw
      description: Full raw response from CriminalIP API.
      type: Unknown

tests:
- Test-CriminalIP
fromversion: 6.10.0